[PATCH] fix for potential integer overflow in zoran driver

From: "Ronald S. Bultje" <R.S.Bultje@students.uu.nl>

Attached patch fixes a potential integer overflow in zoran_procs.c (part of
the zr36067 driver).  Bug was detected by Ken Ashcraft with the Stanford
checker.

drivers/media/video/zoran_procfs.c

@@ -204,6 +204,10 @@ zoran_write_proc (struct file   *file,
 	char *line, *ldelim, *varname, *svar, *tdelim;
 	struct zoran *zr;
 
+	/* Random maximum */
+	if (count > 256)
+		return -EINVAL;
+
 	zr = (struct zoran *) data;
 
 	string = sp = vmalloc(count + 1);